QwikSec

Security Database

CVE

CWE

Training

CVE-2006-0907

Published: Feb 28, 2006

Modified: Aug 7, 2024

PUBLISHED

Description

SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20060225 [waraxe-2006-SA#047] - Evading sql-injection filters in phpNuke 7.8

mailing-list

x_refsource_BUGTRAQ

http://www.waraxe.us/advisory-47.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.